6715f3a284633223116f15cf084079913bce42b28b122861a4ac115bd49070c5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe
Size

80KB
MD5

1ed4c8b43f6b56c58e2e734d2cc5fe74
SHA1

628e06d958b8a390d5524c183c8ecf96080db77e
SHA256

6715f3a284633223116f15cf084079913bce42b28b122861a4ac115bd49070c5
SHA512

a9bfa75b9fe352e69c47b26f6f98d0e195e9a913a445321c8ae13226ab8ccbac3e7a855ebe9a417af83adc00b4033c385a5e4b8d84d13b025ee92709aea0256b
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHFT:vCjsIOtEvwDpj5H9YvQd2F

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012251-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012251-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2708	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2232	2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2708	2232	2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe	28
PID 2232 wrote to memory of 2708	2232	2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe	28
PID 2232 wrote to memory of 2708	2232	2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe	28
PID 2232 wrote to memory of 2708	2232	2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_1ed4c8b43f6b56c58e2e734d2cc5fe74_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
80KB

MD5
d69e2e24fc322da6f1579204e211747f

SHA1
fbd7bbe46dd9c8e35223baad2d211d2ab45c3b0b

SHA256
4ebdfb14d75a3a9672841a2a39dec78a91c6f905221e7dc6899c51bd87628293

SHA512
93bf59763b84374ad23f48fb4e776ae35222eb0f028b9970c7a784c89b51bc6042119de37059193dcf56e834f02bccd54e9fc96b832929c6999bcedf5a817d99

Download Submit
memory/2232-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2232-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2232-7-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2708-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download